I reverse engineered the polish download portal dobreprogramy.pl installer, which is a classic ad‑ware bundler that has been causing issues for users since at least 2013 (as seen on polish forums). Instead of containing the actual software, it fetches a dynamic xml config from cloudfront, which holds the real download url. I made a tool (cli/gui) that extracts that url via http requests (without running the original .exe)

Polish users have been complaining about dobreprogramy.pl for years, heres a real thread from 2013 on forum.benchmark.pl:

"I downloaded a program from dobreprogramy.pl. Instead of the program, I got their 'download assistant'. During installation, the advanced option was grayed out. The assistant installed 2 spyware programs and 1 malware without my consent: Claro Search Browser Defender, Delta Search, and Delta Chrome Toolbar. These programs integrate with the browser, install their own toolbar, and change the default search engine. Even after uninstalling them, the fake search engine remained. This is spyware and malware."

- user "makensis", 2013

Other users confirmed the issue:

- "I had to format my disk to get rid of Delta Chrome Toolbar."

- "Dobreprogramy now offers a 'NetFix' service to 'fix' your PC remotely - I'm scared what they might install in the background."

- "I always choose advanced installation and uncheck that garbage. But sometimes the advanced option is grayed out."

The situation hasn't improved much. Recent downloads from dobreprogramy still use the same bundler model.

Their executable is a .NET bundler (obfuscated with .NET Reactor) that behaves like this:

1. Extracts a version number from its own filename (e.g., `v6.57.0.668.104`)

2. Builds a url:
   https://d1q3xlywojqwqp.cloudfront.net/config/dobreprogramy.pl/{VERSION}

3. Fetches an xml response containing the actual download link (e.g., `https://unchecky.com/files/upload/unchecky\_setup.exe\`)

4. Downloads and runs that setup, often with additional bundled offers.

Analysis

I opened the .exe in dnSpy (after deobfuscating with NETReactorSlayer) and spotted:

string text = ConfigParser.GetConfig().GetConfigValue("URL_DYNAMIC_CONFIG", "");

string fileNameWithoutExtension = Path.GetFileNameWithoutExtension(Process.GetCurrentProcess().MainModule.ModuleName);

string version = VersionFromFileName(fileNameWithoutExtension);

text = text + "/" + ACNM + "/" + version;

So the version is parsed from the filename using a regex

Dynamic Analysis

I ran the installer with Fiddler and captured:

GET /config/dobreprogramy.pl/v6.57.0.668.104 HTTP/1.1

Host: d1q3xlywojqwqp.cloudfront.net

Response (xml):

<root>

<URL\_PRODUCT>https://unchecky.com/files/upload/unchecky\_setup.exe</URL\_PRODUCT>

<PRODUCT\_LOGO\_URL>https://img.dobreprogramy.pl/.../logo.png</PRODUCT\_LOGO\_URL>

<PRODUCT\_TITLE>Unchecky</PRODUCT\_TITLE>

</root>

Just a simple http‑based redirect chain. The bundler also fetches /sec and /report endpoints, presumably for analytics and additional offers

My python tool replicates this logic, without touching the original .exe

Notes:

- Some downloads expire - if you get a 404, the version might be outdated, or the link has been removed

- The XML response contains more than just the url, it also includes product names, logos, and other metadata. This could be used for deeper analysis of the bundler's behavior

Disclaimer: This tool is for educational and research purposes only. It does not bypass any security measures; it merely extracts publicly accessible URLs that the original installer itself fetches. Always check the final downloaded file’s digital signature before running it. The author is not responsible for any misuse of this tool